Analysis of the 2007 Cyber Attacks Against Estonia from the Information Warfare Perspective Rain Ottis Cooperative Cyber Defence Centre of Excellence, Tallinn, Estonia
[email protected] Abstract: Following the relocation of a Soviet-era statue in Tallinn in April of 2007, Estonia fell under a politically motivated cyber attack campaign lasting twenty-two days. Perhaps the best known attacks were distributed denial of service attacks, resulting in temporary degradation or loss of service on many commercial and government servers. While most of the attacks targeted non-critical services like public websites and e-mail, others concentrated on more vital targets, such as online banking and DNS. At the time of this writing – more than six months after the cyber attacks – no organization or group has claimed responsibility for the cyber attacks, although some individuals have been linked with carrying them out. This paper will argue that the key to understanding the cyber attacks that took place against Estonia in 2007 lies with the analysis of an abundance of circumstantial evidence that ran parallel to the cyber attacks. These consisted of political, economic and information attacks on Estonia, as well as isolated cases of physical violence. Clear political signatures were even detected in the malicious network traffic. All told, it is clear that the cyber attacks were linked with the overall political conflict between Estonia and Russia. While some analysts have considered last year’s events in Estonia an international, grass roots, display of public opinion, there are some direct and many indirect indications of state support behind what can be best described as an information operation.